import os, glob, re, shutil

target_roots = [
    "/home2/newspike", "/home2/knsign", "/home2/ulsanih", "/home2/corea-market",
    "/home2/rsc", "/home2/sklo2", "/home2/cfbt", "/home2/coexist", "/home2/gdm",
    "/home2/nanunbom", "/home2/pixelft"
]

print("=== 난독화 C2 로더 폴더 (예: 83492) 및 서브디렉터리 웹셸 정밀 탐지 ===")

deleted_dirs = []
deleted_files = []

for r in target_roots:
    if not os.path.isdir(r):
        continue
    
    # Walk all subdirectories
    for root, dirs, files in os.walk(r):
        # Skip wp-includes, wp-admin, wp-content/plugins, wp-content/themes
        rel = os.path.relpath(root, r)
        parts = rel.split(os.sep)
        if any(p in ['wp-includes', 'wp-admin', 'plugins', 'themes'] for p in parts):
            continue
            
        # Check if dir name is purely numeric (like 83492)
        dirname = os.path.basename(root)
        if dirname.isdigit() and len(dirname) >= 4:
            print(f"  [의심 난독화 폴더 발견] {root}")
            try:
                shutil.rmtree(root)
                print(f"  [삭제 완료 폴더] {root}")
                deleted_dirs.append(root)
                continue
            except Exception as e:
                print(f"  [삭제 실패] {root}: {e}")
                
        # Check files inside non-standard subdirectories
        for f in files:
            if f.endswith('.php'):
                fp = os.path.join(root, f)
                try:
                    with open(fp, 'r', errors='ignore') as file_obj:
                        content = file_obj.read(2048)
                        if 'goto ' in content and 'eval(' in content and ('curl_' in content or 'g8JBF' in content or 'G8Jbf' in content):
                            os.remove(fp)
                            print(f"  [삭제 완료 C2 로더 PHP] {fp}")
                            deleted_files.append(fp)
                except Exception as e:
                    pass

print(f"\n=== 완료: 총 {len(deleted_dirs)}개 의심 폴더 및 {len(deleted_files)}개 C2 로더 파일 추가 삭제 ===")